With rapid development of cloud technologies, increasing quantities of problems arise in application of the cloud technologies. For example, a server in a cloud data center (a cloud server for short) may be attacked by various attack data packets during Internet Protocol (IP) communication, for example, by a distributed denial of service (DDoS) attack and a fraud message attack. Therefore, processing an attack data packet to ensure secure communication for the cloud server becomes one of core technologies of the cloud technologies.
Currently, a common attack data packet processing manner is as follows. By deploying a physical firewall on an entrance cloud server in a cloud data center or deploying a virtual firewall on a hypervisor running on each cloud server in a cloud data center, it is ensured that all data packets waiting to enter the cloud server undergo filtering and forwarding by the physical/virtual firewall; therefore, an attack data packet is filtered out, and the attack data packet is prevented from entering the cloud server, thereby ensuring that the cloud server can perform secure communication. According to a security policy configured for the physical/virtual firewall by working personnel, the physical/virtual firewall identifies IP layer signaling carried by a data packet that waits to enter an IP layer. When the IP layer signaling does not comply with the security policy, the physical/virtual firewall filters out the data packet, which prevents an attack data packet from attacking the cloud server, and further ensures that the cloud server can perform secure communication.
However, in the foregoing method for preventing, using a firewall, an attack data packet from entering a cloud server, only the firewall can be used to prevent the attack data packet from entering the cloud server, and a switch responsible for forwarding a data packet to the firewall may still forward the attack data packet to the firewall, that is, the attack data packet is still transmitted in a network. Therefore, the abnormal data packet occupies a large quantity of network bandwidth, and affects transmission of a normal data packet.